Merge branch 'main' into murrayju/env-output

Author: murrayju

.github/workflows/test.yml

@@ -44,7 +44,7 @@ jobs:
         run: go vet ./...
 
       - name: Test
-        run: go test -p 1 -race -coverprofile=coverage.out -coverpkg=./... ./...
+        run: go test -race -coverprofile=coverage.out -coverpkg=./... ./...
 
       - name: Generate Coverage Report
         run: go tool cover -html=coverage.out -o=coverage.html

CLAUDE.md

@@ -161,6 +161,7 @@ Tiger CLI is a Go-based command-line interface for managing Tiger, the modern da
 - **MCP Server**: `internal/tiger/mcp/` - Model Context Protocol server implementation
   - `server.go` - MCP server initialization, tool registration, and lifecycle management
   - `service_tools.go` - Service management tools (list, show, create, update-password)
+  - `db_tools.go` - Database operation tools (execute-query)
   - `proxy.go` - Proxy client that forwards tools/resources/prompts from remote docs MCP server
 - **Password Storage**: `internal/tiger/password/` - Secure password storage utilities
 
@@ -191,7 +192,9 @@ The Tiger MCP server provides AI assistants with programmatic access to Tiger re
 
 **Two Types of Tools:**
 
-1. **Direct Tiger Tools** (`service_tools.go`) - Native tools for Tiger service management
+1. **Direct Tiger Tools** - Native tools for Tiger operations
+   - `service_tools.go` - Service management (list, show, create, update-password)
+   - `db_tools.go` - Database operations (execute-query)
 2. **Proxied Documentation Tools** (`proxy.go`) - Tools forwarded from a remote docs MCP server (see `proxy.go` for implementation)
 
 **Tool Definition Pattern:**
@@ -281,6 +284,7 @@ Global flags available on all commands:
 - **oapi-codegen**: OpenAPI client generation (build-time dependency)
 - **gomock**: Mock generation for testing (build-time dependency)
 - **go-sdk (MCP)**: Model Context Protocol SDK for AI assistant integration
+- **pgx/v5**: PostgreSQL driver for database operations in MCP tools
 - **Go 1.25+**: Required Go version
 
 ## Project Structure

README.md

@@ -1,6 +1,6 @@
 # Tiger CLI
 
-Tiger CLI is the command-line interface for managing databases on Tiger Cloud.
+Tiger CLI is the command-line interface for Tiger Cloud. It provides commands for managing and querying database services, as well as an integrated Model Context Protocol (MCP) server for use with AI assistants.
 
 ## Installation
 
@@ -166,6 +166,9 @@ The MCP server exposes the following tools to AI assistants:
 - `service_create` - Create new database services with configurable resources
 - `service_update_password` - Update the master password for a service
 
+**Database Operations:**
+- `db_execute_query` - Execute SQL queries against a database service with support for parameterized queries, custom timeouts, and connection pooling
+
 The MCP server automatically uses your CLI authentication and configuration, so no additional setup is required beyond `tiger auth login`.
 
 #### Proxied Tools

internal/tiger/cmd/auth_test.go

@@ -22,6 +22,9 @@ import (
 func setupAuthTest(t *testing.T) string {
 	t.Helper()
 
+	// Use a unique service name for this test to avoid conflicts
+	config.SetTestServiceName(t)
+
 	// Mock the API key validation for testing
 	originalValidator := validateAPIKeyForLogin
 	validateAPIKeyForLogin = func(apiKey, projectID string) error {
@@ -47,10 +50,6 @@ func setupAuthTest(t *testing.T) string {
 		t.Fatalf("Failed to use test config: %v", err)
 	}
 
-	// Also ensure config file doesn't exist
-	configFile := config.GetConfigFile(tmpDir)
-	os.Remove(configFile)
-
 	t.Cleanup(func() {
 		// Clean up test keyring
 		config.RemoveAPIKeyFromKeyring()

internal/tiger/cmd/auth_validation_test.go

@@ -18,6 +18,9 @@ func TestAuthLogin_APIKeyValidationFailure(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpDir)
 
+	// Use a unique service name for this test
+	config.SetTestServiceName(t)
+
 	originalValidator := validateAPIKeyForLogin
 
 	// Mock the validator to return an error
@@ -73,6 +76,9 @@ func TestAuthLogin_APIKeyValidationSuccess(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpDir)
 
+	// Use a unique service name for this test
+	config.SetTestServiceName(t)
+
 	originalValidator := validateAPIKeyForLogin
 
 	// Mock the validator to return success

internal/tiger/cmd/db_test.go

@@ -328,6 +328,9 @@ func TestLaunchPsqlWithAdditionalFlags(t *testing.T) {
 }
 
 func TestBuildPsqlCommand_KeyringPasswordEnvVar(t *testing.T) {
+	// Use a unique service name for this test to avoid conflicts
+	config.SetTestServiceName(t)
+
 	// Set keyring as the password storage method for this test
 	originalStorage := viper.GetString("password_storage")
 	viper.Set("password_storage", "keyring")
@@ -950,6 +953,9 @@ func TestDBConnectionString_WithPassword(t *testing.T) {
 	// This test verifies the end-to-end --with-password flag functionality
 	// using direct function testing since full integration would require a real service
 
+	// Use a unique service name for this test to avoid conflicts
+	config.SetTestServiceName(t)
+
 	// Set keyring as the password storage method for this test
 	originalStorage := viper.GetString("password_storage")
 	viper.Set("password_storage", "keyring")

internal/tiger/config/api_key.go

@@ -12,22 +12,40 @@ import (
 
 // Keyring parameters
 const (
-	keyringServiceName     = "tiger-cli"
-	keyringTestServiceName = "tiger-cli-test"
-	keyringUsername        = "api-key"
+	keyringServiceName = "tiger-cli"
+	keyringUsername    = "api-key"
 )
 
+// testServiceNameOverride allows tests to override the service name for isolation
+var testServiceNameOverride string
+
 // GetServiceName returns the appropriate service name for keyring operations
-// Uses a test-specific service name when running in test mode to avoid polluting the real keyring
 func GetServiceName() string {
-	// Use Go's built-in testing detection
+	// Tests should set a unique service name to avoid conflicts
+	if testServiceNameOverride != "" {
+		return testServiceNameOverride
+	}
+
+	// In test mode without an override, panic to catch missing test setup
 	if testing.Testing() {
-		return keyringTestServiceName
+		panic("test must call SetTestServiceName() to set a unique keyring service name")
 	}
 
 	return keyringServiceName
 }
 
+// SetTestServiceName sets a unique service name for testing based on the test name
+// This allows tests to use unique service names to avoid conflicts when running in parallel
+// The cleanup is automatically registered with t.Cleanup()
+func SetTestServiceName(t *testing.T) {
+	testServiceNameOverride = "tiger-test-" + t.Name()
+
+	// Automatically clean up when the test finishes
+	t.Cleanup(func() {
+		testServiceNameOverride = ""
+	})
+}
+
 // storeAPIKey stores the API key using keyring with file fallback
 func StoreAPIKey(apiKey string) error {
 	// Try keyring first

internal/tiger/config/api_key_test.go

@@ -4,13 +4,14 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
-
-	"github.com/spf13/viper"
 )
 
 func setupAPIKeyTest(t *testing.T) string {
 	t.Helper()
 
+	// Use a unique service name for this test to avoid conflicts
+	SetTestServiceName(t)
+
 	// Clean up any existing keyring entries before test
 	RemoveAPIKeyFromKeyring()
 
@@ -20,8 +21,11 @@ func setupAPIKeyTest(t *testing.T) string {
 		t.Fatalf("Failed to create temp dir: %v", err)
 	}
 
-	// Wire up the tmp directory as the viper config directory
-	viper.SetConfigFile(GetConfigFile(tmpDir))
+	// Reset viper completely and set up with test directory
+	// This ensures proper test isolation by resetting all viper state
+	if _, err := UseTestConfig(tmpDir, map[string]any{}); err != nil {
+		t.Fatalf("Failed to use test config: %v", err)
+	}
 
 	t.Cleanup(func() {
 		// Clean up keyring entries
@@ -69,15 +73,15 @@ func TestStoreAPIKeyToFile(t *testing.T) {
 
 func TestGetAPIKeyFromFile(t *testing.T) {
 	tmpDir := setupAPIKeyTest(t)
-	viper.SetConfigFile(GetConfigFile(tmpDir))
 
 	// Write API key to file
 	apiKeyFile := filepath.Join(tmpDir, "api-key")
 	if err := os.WriteFile(apiKeyFile, []byte("file-get-test-key"), 0600); err != nil {
 		t.Fatalf("Failed to write test API key file: %v", err)
 	}
 
-	// Get API key from file
+	// Get API key - should get from file since keyring is empty
+	// (each test uses a unique keyring service name)
 	apiKey, err := GetAPIKey()
 	if err != nil {
 		t.Fatalf("Failed to get API key from file: %v", err)
@@ -89,8 +93,7 @@ func TestGetAPIKeyFromFile(t *testing.T) {
 }
 
 func TestGetAPIKeyFromFile_NotExists(t *testing.T) {
-	tmpDir := setupAPIKeyTest(t)
-	viper.SetConfigFile(GetConfigFile(tmpDir))
+	setupAPIKeyTest(t)
 
 	// Try to get API key when file doesn't exist
 	_, err := GetAPIKey()
@@ -105,7 +108,6 @@ func TestGetAPIKeyFromFile_NotExists(t *testing.T) {
 
 func TestRemoveAPIKeyFromFile(t *testing.T) {
 	tmpDir := setupAPIKeyTest(t)
-	viper.SetConfigFile(GetConfigFile(tmpDir))
 
 	// Write API key to file
 	apiKeyFile := filepath.Join(tmpDir, "api-key")

internal/tiger/password/connection_test.go

@@ -9,6 +9,7 @@ import (
 	"github.com/spf13/viper"
 
 	"github.com/timescale/tiger-cli/internal/tiger/api"
+	"github.com/timescale/tiger-cli/internal/tiger/config"
 	"github.com/timescale/tiger-cli/internal/tiger/util"
 )
 
@@ -186,6 +187,9 @@ func TestBuildConnectionString_Basic(t *testing.T) {
 }
 
 func TestBuildConnectionString_WithPassword_KeyringStorage(t *testing.T) {
+	// Use a unique service name for this test to avoid conflicts
+	config.SetTestServiceName(t)
+
 	// Set keyring as the password storage method for this test
 	originalStorage := viper.GetString("password_storage")
 	viper.Set("password_storage", "keyring")
@@ -328,6 +332,9 @@ func TestBuildConnectionString_WithPassword_NoStorage(t *testing.T) {
 }
 
 func TestBuildConnectionString_WithPassword_NoPasswordAvailable(t *testing.T) {
+	// Use a unique service name for this test to avoid conflicts
+	config.SetTestServiceName(t)
+
 	// Set keyring as the password storage method for this test
 	originalStorage := viper.GetString("password_storage")
 	viper.Set("password_storage", "keyring")
@@ -366,6 +373,9 @@ func TestBuildConnectionString_WithPassword_NoPasswordAvailable(t *testing.T) {
 }
 
 func TestBuildConnectionString_WithPassword_InvalidServiceEndpoint(t *testing.T) {
+	// Use a unique service name for this test to avoid conflicts
+	config.SetTestServiceName(t)
+
 	// Set keyring as the password storage method for this test
 	originalStorage := viper.GetString("password_storage")
 	viper.Set("password_storage", "keyring")

internal/tiger/password/password_storage_test.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/spf13/viper"
 	"github.com/timescale/tiger-cli/internal/tiger/api"
+	"github.com/timescale/tiger-cli/internal/tiger/config"
 	"github.com/timescale/tiger-cli/internal/tiger/util"
 )
 
@@ -573,6 +574,10 @@ func TestPasswordStorage_OverwritePreviousValue(t *testing.T) {
 		{
 			name:    "KeyringStorage",
 			storage: &KeyringStorage{},
+			setup: func(t *testing.T) {
+				// Use a unique service name for this test to avoid conflicts
+				config.SetTestServiceName(t)
+			},
 			cleanup: func(t *testing.T, service api.Service) {
 				storage := &KeyringStorage{}
 				storage.Remove(service) // Ignore errors in cleanup